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Abstract — We discuss the use of elliptic curves in 
cryptography on high-dimensional surfaces. In particular, 
instead of a key exchange protocol written in the form of a 
bi- dimensional row, where the elements are made up with 
256 bits, we propose a Diffie-Hellman key exchange 
protocol given in a matrix form, with four independent 
entries each of them constructed with 64 bits. Apart from 
the great advantage of significantly reducing the number 
of used bits, this methodology appears to be immune to 
attacks of the style of Western, Miller, and Adleman, and 
at the same time it is also able to reach the same level of 
security as the cryptographic system presently obtained by 
the Microsoft Digital Rights Management. A nonlinear 
differential equation (NDE) admitting the elliptic curves as 
a special case is also proposed. The study of the class of 
solutions of this NDE is in progress. 

Keywords — Elliptic-curve cryptography, Elliptic-curve 
discrete log problem, Public key cryptography, Nonlinear 
differential equations. 

I. INTRODUCTION 

As known, encryption is the conversion of electronic data 
into another form, called ciphertext , which cannot be easily 
understood by anyone except authorized parties. The 
primary purpose of encryption is to protect the 
confidentiality of digital data stored on computer systems 
or transmitted via the Internet or other computer networks. 
Encryption algorithms can provide not only 
confidentiality, but also authentication (i.e., the origin 
message is verified), integrity (i.e., the contents of the 
message have not been changed), and non-repudiation (i.e., 
the sender cannot deny to be the author of the message) 
[1,2]. Elliptic curves are more and more used in 
cryptography [3,4]. The main advantages to use the elliptic 
curves in cryptography is that shorter encryption keys use 
fewer memory and CPU resources [5]. The main concept 
behind this is the use of the so-called one-way functions. A 
one-way function is a function for which it is relatively 
easy to compute the image of some elements in the domain 


but it is extremely difficult to reverse this process and 
determine the original element solely based on the given 
image [6]. More precisely, according to the Federal Office 
for Information Security (BSI), the recommended security 
parameters for elliptic curves is 256 bits (standards during 
the years 2017-2021) [7]. However, to manipulate data 
with this degree of security is computationally expensive 
and often impossible on embedded systems. At present 
many industrial systems adopt (much) less secure 
methodologies. This necessitates a re-evaluation of our 
cryptographic strategy. The question is: are we able to 
obtain the same degree of security with small embedded 
microprocessors managing only 64-bit operations? The 
solution of this problem entails several steps: 

A) First step: Research 

The solution of this problem requires new mathematical 
concepts and algorithms. 

B) Second step: Commercialization 

Once found the solution, the process is concluded with the 
start-up of the commercialization of the product. 

This manuscript deals only with the first step. We shall 
introduce a hyper-surface in an arbitrary (n I. 2 + 1)- 
dimensional space with n denoting a positive integer 
number), and we use the idea of the one-way function 
possessing also the property of being a trap function. The 
encrypted shared-key, instead to be written as a (very 
large) scalar number is brought into a matrix form. We 
shall prove that we may obtain the same degree of security 
as the one obtained by the Microsoft Digital Rights 
Management by sending an encrypted shared-matrix with 
four independent entries, each of them made up by 64 bits. 
The encrypted information is successively transmitted 
through elliptic curves obtained by projecting the hyper- 
surface imbedded in a (n 2 +l)-dimensional space onto 
perpendicular planes. This methodology allows reaching 
the same level of security as the cryptographic system 
presently obtained by the Microsoft Digital Rights 
Management [8]. 
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The manuscript is organized as follows. In Section (II) we 
introduce high-dimensional surfaces cryptography 
(HDSC) and the elliptic curves constructed through these 
hyper-surfaces. Without loss of generality, we shall limit 
ourselves to the case of n = 2 (i.e., to a 5D -space). The 
generalization to (n 2 + 1) -dimensional space is 
straightforward. The definition of the groups in elliptic 
curves on high-dimensional surfaces and the elliptic curve 
discrete log problem can be found in the Subsections (II- 
A) and (II-B), respectively. Concluding remarks are 
reported in the Section (IV). 


with i = (1, ...,4) and 

b\ = b + C2 + C3 + C4 + CL2C2 + ^3 C 3 CL4C4 

62 = b + Ci + C3 + + a\C\ + (23 C3 + <24 C4 

6 3 = b + Ci + C2 + C4 + a\C\ + (22 c 2 ^ 4 C 4 

64 = b + C3 + C2 + C3 + aiCi + (22 c 2 <23 C3 

being q (i = 1, ...,4) elements of K. In order to avoid 
degeneracy, these parameters are subject to the following 
restrictions 


II. ELLIPTIC-CURVES CRYPTOGRAPHY ON 
HIGH DIMENSIONAL SURFACES 

We illustrate the methodology by dealing with a five- 
dimensional elliptic curve, even though the procedure is 
straightforwardly generalized to elliptic curves on surfaces 
imbedded in an arbitrary (n 2 +l)-dimensional space, with 
n denoting a positive integer number (the reason for which 
only spaces of such dimension are allowed will soon be 
clear). For the sake of simplicity, in this work we shall limit 
ourselves to the analysis of elliptic curves on 5- 
dimensional surfaces. The generalization to the general 
case (i.e., to the case of elliptic curves on (n 2 + 1 ^hyper- 
surface) is straightforward 1 . In a 5-dimensional space, the 
surfaces on which the elliptic curves are defined, are the 
solutions of the equation 

4 

E= {(y,x 1 ,x 2 ,x 3 ,x 4: ) I y 2 = + A-X + &I (1) 

i= 1 

where A = (ai, a 2 , a 3 , afj ; X = 

with a t (i = 1, ... , 4) and b denoting elements of the field 
K. Examples of fields K are the Real Numbers, R , the 
Rational Numbers, Q, the Complex Numbers, C, or the 
Integers modulo p, Z/pZ. By fixing three of the four 
variables x t (by setting, for example, x 2 = c 2 = const., 
x 3 = c 3 = const, and x 3 = c 3 = const.) and by rotating 
the indexes, Eq.(l) defines together with the points at 
infinity 0, four distinguished two-dimensional elliptic 
curves E t : 

Ei = {(?/,£;) I y 2 = x\ + aiXi +6i) U {0} (2) 



4 cii + 27 (b + c 2 + C3 + C4 + CL2C2 + (13C3 T* U4C4) 2 / 0 ( 3 ) 

4*22 + 27 (b + Ci + C3 + C4 + a\C\ + a 3 c 3 + <24 C4) 2 / 0 

4*23 27(6 + Ci + c 2 + C4 + aiCi + (22C2 + U4C4) 2 / 0 

4*24 + 27 (b + + c 2 + C3 + a\C\ + CL2C2 + U3C3) 2 / 0 


Clearly, in case of K = Z/pZ we may associate four 
modules p to each elliptic curves. As we shall see in the 
forthcoming section, only elliptic curves on hyper-surfaces 
of dimension n 2 +l (with n denoting a positive integer 
number) are acceptable since the shared-key involves only 
square matrices of order nXn For illustration purpose 
only, Fig.(l) shows a three dimensional surface where the 
values of the parameters are a x — — 4, a 2 — —5 and b = 
3.5 . Figs. (2) and (3) refer to the elliptic curves obtained by 
projecting the surface (1) onto the planes x t = 1 and x 2 = 
—2 , respectively. 

A. Groups in Elliptic Curves on High-Dimensional 

Surfaces 

Each elliptic curve E h separately, defines under point 
addition an abelian group. For each P t E E t , Q t E E t and 
R t E E t the following properties are satisfied: 


• Commutative : Pi + Q t = Q t + Pp 

• Identity : P t + 0 = 0 + P t = P t ; 

• Inverse : P t — P t = P t + (— P t ) = 0; 

• Associative : P t + (Q t + Ri) = (P t + Q t ) + R t 

• Closed : If P t E E t and Q t E E t , then P t + Q t E E t 


1 In fact, we anticipate that the encrypted code involves 
only square matrices of order nXn - see next Section. 
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fig. 1: Only for illustration purpose ; we show the two-dimensional surface given by Eq.(2) with parameters a x = —4, a 2 = — 5 and 
b = 3.5. However , one should bear in mind that only elliptic curves on hyper-surfaces of dimension n 2 +l have real meaning (hence, 
only elliptic curves constructed by hyper-surfaces of dimensions 2, 5, 10, and so on, are acceptable). This because, as we shall see in the 
forthcoming section, the encrypted code involves only square matrices of order nxn. 


y 



fig. 2: Elliptic curve obtained by projecting the surface (1) onto 
the plane x ± = 1 . 


Each group identified by E t is equipped with the standard 
group operations [9,10], i.e. 

• Addition - If P t = ( P ix , P iy ) E E t and Q t = 
0 Qix> Qiy) G E h then P t + Q t = R t [with R t = 
(. Rix , Riy)] which algebraically is defined as 


Rixi $i {_P%Xi “h Qixi) 
Piy — Sii^PiXi Pix \ ) Pi 


Si = 


Piy ~ Q 


zy 


P- 

- 1 7.7 


Qi 


( 4 ) 


for i = (1, ... , 4). As a particular case, we get 2 P: 



fig. 3: Elliptic curve obtained by projecting the surface (1) onto 
the plane x 2 = -2. 


2 Pixi = $i ~ 2 Pixi (5) 

2-Pij/ — Rixt) e%y 

3 P? x . + 

2 P 

ty 


with i = (1, ...,4). The points at infinity are reached in 
each elliptic curves E t when P t + Q t = 0 if P ix . = Q ix . or 
when y = 0 for point doubling (i.e., P t + P t = 0). 

• Scalar Multiplication - If P t E E t and k E Z Eq.(5) 
allows defining the operation Q = kP under the 
condition that the operation Q = kP = P + — V P 
equals k times p , is performed by using the same 
elliptic curve E t i.e., Q E E t . The scalar multiplication 
defines the one-way function Q -> P where is very 
difficult to extract the value of k 
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• Reflection - The reflection of a point is its inverse. 

Hence for P t = (P ix , P iy ) the inverse of P t is —P t = 

(P ix , — P ^ ) satisfying the relation P t — P t = 0. 

B. High-Dimensional Elliptic Curve Discrete Log 

Problem 

For each E t the scalar multiplication defines a one way 
function [11]. Let us consider elliptic curves E t (Z/pZ ), 
with p = (Pi, ... ,p 4 ) and let Q 1 and P 1 two points 
belonging to the same elliptic curve, say E l9 with the 
condition that Q_ 1 is a multiple of P 1 . As known, finding 
the value of the number k such that Q 1 = kP 1 is a very 
difficult problem [12]. We introduce now the first base 
point ( Generator ), G 1 = ( G x , G y )\in E ± (Z/pZ ). Since the 
group is closed , G x generates a cyclic group under point 
addition in the curve Zq. The order n x (withrq E k) of G 1 
is the number of the points in the group that G x generates. 
By this operation, we say that G x generates a subgroup of 
size rq , and we write ord^Gf) = n 1 . The order of the 
subgroup generated by G x is the smallest integer /q such 
that k 1Gl = 0 (hence, n x < /q). 

After 7q iterations on the curve E 1 we find a second base 
point ( Generator ), G 2 with coordinates G 2 (n 1 ) = 
[G x2 (nf), G y2 (n 1 )]. We may keep this second generator to 
perform n 2 iterations on the curve E 2 , with n 2 < k 2 being 
k 2 the order of the subgroup generated by G 2 on the elliptic 
curve E 2 . After n 2 iterations we get a third base point ( 
Generator ), G 3 with coordinates G 3 (n 2 ) = 

[G x3 (n 2 ),Gy 3 (n 2 )]. With this second generator we 
perform n 3 iterations on the curve E 3 , with n 3 < k 3 (with 
k 3 denoting the order of the subgroup generated by G 3 on 
the elliptic curve E 3 .After n 3 iterations on the curve E 3 we 
get the fourth base point ( Generator ), G 4 with coordinates 
G 4 (n 3 ) = [G^Oq), G y4 (n 3 )].. The process concludes 
after n 4 iterations on the elliptic curves E 4 (with n 4 less 
than k 4 the order of the subgroup generated by G 4 on the 
curve E 4 ). At the end of these operations we get three 
matrices N, G and K , of order 2x2, where the entries are 
totally independent from each others. Matrices N and G 
reads 2 


N = 

( ni 

n 2 


V n 3 

n 4 

K = 

f K 1 

^2 


V^3 

K 4 


f G Xl 6^2 ( n i A 

y (77,2) G X 4 (n 3 ) J 

( 6 ) 


The parameters that also Eve, the eavesdropper, possesses 
are (p it a it b it G ,K) with i = (1, ...4). p t specifies the 
modulo of the fields K t , a t and b t define the elliptic curves 
E t (notice that in general these curves are different from 
each others), G is the Generator matrix and K is the order 
of the subgroups generated by G, respectively. Now, if Bob 
and Alice want to communicate with each other, Bob picks 
private key N with 1 < n t < k t — 1, i = (1, ... 4). Bob 
computes matrix T = GN, which belongs to the curves E 
[given by Eq.(l)]. At the same time, Alice picks private key 
M 

M = ( mi m A (7) 

\m 3 m 4 J 

where the entries mi satisfy the conditions 1 < mi < k t — 
1, i = (1, ... 4). Alice receives from Bob the information T 
and she generates the point MT = MGN = W (notice that 
matrices do not commute). Bob receives from Alice the 
information P = MG and he computes PN = MGN = W. 
Note that Bob multiplies matrices by placing N always on 
the right, while Alice multiplies matrices by placing M 
always on the left. Both players, Bob and Alice, possess the 
same (encrypted) key W , which also belongs to the curve 
E [given by Eq.(l)]. Eve, the eavesdropper, sees both 
information T and P, but she is unable to retrieve the 
sheared-key W . Fig.(4) depicts the entire process. 



compute: 

PN = MGN = W 

I 


compute 
MT = MGN = W 

I 


fig. 4: Diffie-Hellman key exchange protocol [13] in high- 
dimensional elliptic curves cryptography. Bob and Alice exchange 


2 Note that, once generated, the elements G(x ± ), G x .(ni) 
may be allocated as entries of the matrix G in a random 
way. 
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the encryption key in a matrix form , W = MGN, having four 
independent entries each of them constructed with 64 bits. Eve , 
the eavesdropper , may see T = GN and P = MG, but he is 
unable to get the sheared Bob-Alice's key W since it is very 
difficult to reverse the process and determine what was the 
original information. 

We summarize the main advantages of our proposed 
encrypting procedure. 

• Eve does not know to which entry of the matrix G 
the generators have been assigned; 

• In case of 5D -elliptic curves, the process runs on 
four, distinguished and independent, 2D -elliptic 
curves and the encrypted key belongs to a 5 D- 
surface. This hyper-surface is constructed in such a 
way that the curves with variables x h obtained by 
setting constant the remaining variables of this 
hyper-surface (i.e., by setting Xj = const, with i =£ 
j), are elliptic curves; 

• The level of security remains unchanged. Indeed, it 
is easily to convince ourselves that to obtain the 
same level of security as in case of one-dimensional 
elliptic curve cryptography (which requires 256 
bits), we need to encrypt the shared-key with only 
64 bits (since in our case, for a shared-key written in 
the form of a 2x2 matrix, the level of security is of 
the order of a 4 , with a denoting the number of 
required bits). 

We recall that the present methodology applies to elliptic 
curves cryptography constructed on hyper-surfaces of 
dimension n 2 + 1 (with n denoting an integer number) 
because the shared-key is brought into the form of nxn 
square matrices. Hence, a surface like Eq.(l) is the 
immediate generalization of the one-dimensional elliptic 
curves cryptography (which corresponds to n = 1). Hence, 
the subsequent surface which generalizes Eq.(l) should be 
imbedded in a ten-dimensional space (n = 3), and so on. 

III. EXAMPLES OF PRACTICAL USES OF 
HIGH-DIMENSIONAL ELLIPTIC CURVE 
CRYPTOGRAPHY 

The aim of this section is to illustrate the many possibilities 
and practical usages opened by the introduction of High- 
Dimensional Elliptic Curve Cryptography. Generally 
speaking, HDECC can be applied instead of any use of the 
classic ECC; i.e., Bitcoin, secure shell ( ssh ), transport layer 
security ( tls ) [14]. Among these applications, one of the 
most important is certainly tls. Indeed, tls is the new 
generation of the Secure Socket Layer (ssl) which is used 
in any modern telecommunication. For instance, the well- 
known https is nothing else than the classic http protocol 
running over ssl/ tls in order to ensure a secured, 


bidirectional connection for arbitrary binary data between 
two hosts. In order to establish a shared key between these 
two hosts, the current implementations of tls relies on the 
DH or ECDH key exchange protocols discussed in the 
previous sections. 

However, introducing such security layers comes at the 
price of overheads in terms of infrastructure costs, 
communication latency, data usage, and energy 
consumption [15]. Therefore, the first motivation of 
HDECC is to reduce the cost of security in many of the 
today’s state-of-the-art communication technologies. 
Moreover, reducing these costs makes the most modern 
security protocols accessible for embedded systems and 
wearable devices. Indeed, by using HDECC, we could 
reduce the cost of these protocols by performing operations 
on data four time shorter than before by maintaining, at the 
same time, the same level of security. In addition, HDECC 
opens new perspectives on elliptic curve cryptography as 
we shall discuss in the next section. 

IV. CONCLUSION 

We have proposed an encrypted procedure based on the 
high-dimensional elliptic curve cryptography, which 
allows maintaining the same level of security as presently 
obtained by the Microsoft Digital Rights Management. The 
advantages of these methodology are multiplex. 

1) The quite heavy intermediate exponential operations 
are avoided and the key exchange protocol is 
constructed with 64 bits operations instead of 256 bits. 

2) We may proceed to the construct of a new generation 
of cryptographic standards working with the 
technology high-dimensional elliptic curves 

3) This methodology opens new perspectives. In fact, it 
is not difficult to derive a nonlinear differential 
equation (NDE) admitting the elliptic curves by a 
special choice of the parameters and initial conditions. 
We get 

y" + aiO)y _1/2 y" + a 2 {x)y~ 1/2 y' + a 3 (x)y~ 3/2 y' 2 
+ y(x) = 0 

y( 0) = A ; y'(o) = p 2 (8) 

with afx) = cti + b t x (i=l ,2,3) ; y(x) = y 1 + y 2 x 
and a it b if (3 lf (3 2 ,Yi,Y 2 = const. 

with ' denoting the derivative with respect to the variable 

x. Differential equation (8) is well-weighted with variables 

y, y',y" and y(x) having weight 1 and a t (x) having 
weight 1/2, respectively. Note that the differential 
equation (8) admits as a special solution the Weierstrass 
equation [16] 

y 2 + c t xy + c 3 y = x 3 + c 2 x 2 + c 4 x + c 6 (9) 

with c t e K. If CharK =£ (2,3), we can complete before 
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the square and, successively, the cube, by defining 


, C\X + c 3 cl + 4c 2 

^ = y ^ 2 ; ^ = x ^ 12 


( 10 ) 


By substituting Eqs (10) into Eq.(9), we get the elliptic 
curve [17]: 


v 2 = e 


48 


de_ 

864 


( 11 ) 


where 
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d 4 = (cl + 4 c 2 ) 2 - 24 (c 1 c 3 + 2c 4 ) (12) 

d 6 = —(cl + 4c 2 ) 3 + 36(cj + 4 c 2 )(c 1 c 3 + 2c 4 ) 

— 216(cf + 4 c 6 ) 

Clearly, now the question is: how can we determine the 
largest class of parameters a ir b it and (3 2 , introduced in 
(8), such that the NDE (8) admits (only) a class of one way 
functions, possessing the property of being trap functions ? 
In addition, we should also be able to define on these 
curves a group under point addition. Successively, the 
trapped curves could be identified uniquely by indexes. 
Being able to answer to this question would allow 
encrypting not only the key exchange protocol but also the 
trapped-curves on which the generator and the encrypted 
keys belong. However, all of this requires sophisticated 
mathematical tools and it will be subject of future works. 

We close this Section by mentioning two other relevant 
perspectives of this work. 

1) It is quite evident that the formalism illustrated in this 
manuscript allows introducing two operations: matrix 
addition and scalar matrix multiplication (including 
the so-called matrix doubling operation). These 
operations can be used to implement a high- 
dimensional version of algorithms such as the ECDSA 
(elliptic curves digital signature algorithm) [18]. 

2) It is possible to introduce an operator L which 
connects two distinct points G^\G^ on the high- 
dimensional surface E [see Eq.(l)] as follows 

G (1) =LG (2) (13) 

(G ( y G^>(n 1 )\ = fG^ C®(n 4 )\ 

\ /?G) /"CD A, ^ / \ rS 2 ^ rS^Cn \ / 


with L denoting a non-singular 2x2 matrix, satisfying the 
group law under matrix multiplication. The analytic 
expression and the mathematical study of this matrix (and 
the n xn matrices, in general), with its potential application 
in cryptography, will be subject of a future work. 
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